WhatsApp says a hacking campaign hit under 200 users worldwide

Post by : Monika

photo: Reuters

WhatsApp, the world’s most popular messaging app owned by Meta, has recently discovered a new and very advanced hacking attack. This attack was not like normal hacking attempts where people need to click on a suspicious link or download a file. Instead, this spyware could secretly break into someone’s phone without the person doing anything.

This kind of attack is called a “zero-click hack.” It is one of the most dangerous forms of hacking because users have no way of knowing they were targeted until it is too late. According to WhatsApp, fewer than 200 people worldwide may have been affected, but the case shows a much bigger problem in the way phones and apps can be attacked.

How the Hack Worked

• The hackers did not rely on one weakness. Instead, they used a chain of two different flaws:
• A weakness inside WhatsApp itself.
• A flaw in Apple devices such as iPhones and Macs.

By combining these two weak spots, the attackers could completely take control of a phone. Once inside, they could read private messages, access photos, record calls, and even spy on other apps. This means it was not only WhatsApp that was at risk. Other apps on the affected phones, including important work tools and email, could also have been exposed.

This shows how dangerous spyware can be. It does not only affect one app—it can spread across a person’s entire device.

Who Was Targeted?

WhatsApp has said that fewer than 200 people worldwide were hacked. At first, this number may sound small compared to the billions of people who use WhatsApp every day. But experts say the choice of victims makes this case very serious.

The people targeted appear to be connected to civil society organizations. These include human rights workers, activists, journalists, and people helping communities in need. Such groups often need strong protection because they may be working in places where governments or powerful groups want to silence them.

Hackers who target civil society are usually not regular criminals. Instead, they are often linked to powerful organizations or even governments. This is why the discovery is raising global concerns.

Amnesty International Joins the Investigation

To understand the full impact of the attack, WhatsApp has partnered with Amnesty International’s Security Lab. This team, led by security expert Donncha O Cearbhaill, is carefully examining the affected phones.

Amnesty International has often studied spyware attacks before. For example, they have looked into the use of Pegasus spyware, which has been used in the past against journalists and activists around the world. Their role in this case is to identify how the attack spread, who was targeted, and what information might have been stolen.

By involving Amnesty, WhatsApp is showing that this is not just a technical issue. It is also a human rights issue. Protecting digital security means protecting people’s freedom of speech, privacy, and safety.

Why This Attack Matters

This spyware attack is not only about 200 people. It points to bigger problems with how secure—or insecure—our phones and apps really are. Let’s break down why this matters so much:

1. Zero-Click Hacks Are Extremely Dangerous

Normally, people can avoid hacking by being careful. They don’t click suspicious links, don’t download unknown files, and keep their apps updated. But in a zero-click attack, none of that matters. Hackers can break into a phone without the person doing anything at all. This makes the attack almost impossible to detect or stop in time.

2. High-Risk Targets Were Chosen

The people attacked were not random. They were activists, human rights defenders, and people working for society. These groups often challenge powerful interests, so they are high-value targets. If their phones are hacked, sensitive information about communities, protests, or investigations could fall into the wrong hands.

3. Cross-Device Weaknesses

The attack worked by combining weaknesses in both an app (WhatsApp) and a device (Apple’s iPhone and Mac). This shows how hackers are becoming smarter. Instead of breaking one lock, they find two weak locks and use them together to open the door.

4. The Need for Fast Action

WhatsApp has already fixed the weaknesses that allowed the attack. But experts warn that this is only the beginning. Every app and device can have flaws. The question is how quickly companies find and repair them. If updates are delayed, millions of users could be at risk.

5. Collaboration Between Tech and Human Rights

The involvement of Amnesty International shows that this is more than a technical fight. Protecting against spyware also means protecting people’s rights and freedoms. Tech companies, researchers, and human rights groups must work together to stay ahead of attackers.

What Is Spyware?

To understand the seriousness of this case, it is important to know what spyware is. Spyware is a type of software that secretly enters a device and steals information. Unlike normal viruses, spyware is usually built to be very quiet. Victims often do not realize they are being watched.

Spyware can:

• Read private messages and emails.
• Record phone calls and even video.
• Track the user’s location in real time.
• Access files, photos, and contact lists.
• Use the camera or microphone without permission.

In short, spyware turns someone’s personal phone into a spying device against them.

Other Spyware Cases

This is not the first time such an attack has been discovered. In the past, spyware like Pegasus, created by an Israeli company, has been used to target politicians, activists, and journalists worldwide. In many cases, governments have been accused of using spyware against critics.

The WhatsApp case is different because it shows how attackers are still finding new ways to break into even the most secure apps. This reminds everyone that the battle between hackers and defenders never ends.

How Users Can Protect Themselves

• While zero-click attacks are nearly impossible for normal users to stop, there are still some important steps people can take to stay safer:
• Always update apps and devices. Updates often contain security fixes.
• Use official app stores. Do not download apps from unknown websites.
• Turn on automatic updates. This makes sure devices get security patches quickly.
• Be alert for strange behavior. If a phone suddenly gets slower, uses more battery, or behaves oddly, it may be a sign of spyware.
• Work with experts if at risk. Journalists, activists, and civil society groups should connect with digital security organizations for training and support.

A Wake-Up Call for the Tech World

This spyware campaign is a warning for the tech industry and governments around the world. It shows that even the most trusted apps and devices can be broken into if attackers are determined enough.

For companies like Meta (which owns WhatsApp) and Apple, it is a reminder that they must constantly improve their defenses. For users, it is a reminder to stay informed and keep their devices updated.

But most importantly, this case highlights the human side of digital security. When activists and human rights workers are targeted, it is not just about technology—it is about protecting voices that speak up for justice and freedom.

The discovery of this WhatsApp spyware attack is a major development in the world of cybersecurity. While fewer than 200 people were targeted, the impact goes far beyond numbers. The fact that activists and civil society members were the main victims shows that spyware is being used to watch and silence important voices.

WhatsApp has acted quickly to fix the flaws, and Amnesty International is working to understand the full picture. But this case will not be the last. As technology grows more advanced, so do the attacks. The world must stay alert, and cooperation between tech companies, human rights groups, and governments is more important than ever.

The lesson is clear: protecting our digital lives is not only about convenience—it is about protecting our freedom and security in the modern world.

hacking campaign